EP3033855B1 - Support for decryption of encrypted data - Google Patents

Description

Field of the invention

The present invention relates, inter alia, to methods, apparatuses, systems, programs, and storage media for supporting decryption of encrypted data.

Background of the invention

Today, data can be sent digitally, for example by e-mail. Traditional email is not suitable for confidential information for a variety of reasons. On the one hand, neither sender nor recipient can be unequivocally identified. This means that the recipient of an email can not be sure that the sender is actually the person or institution specified as the sender. Second, the information is transmitted openly, which means that misusers can be read by the mistaken recipient. In addition, the provider of the email function, via whose server the email is transmitted, can take note of the information from the email.

The content of electronic messages can be protected by end-to-end encryption, so that the message can not be read by any third party during transport from the sender to the recipient. Here, a sender must cryptographically encrypt a message or part of a message, and the recipient must decrypt the message. The encryption can be a symmetric encryption; in that case, encryption and decryption are based on the same key. Alternatively, the encryption may be asymmetric encryption; in that case the encryption may be based on a public key of a key pair and the decryption on the private key of the key pair. Traditionally, the recipient must independently manage and protect his or her key or keys, the latter both from loss and from unauthorized reading by third parties. In addition, he must make the sender the key necessary for encryption. In addition, on the receiver side the installation of software modules and possibly additional devices, such as card readers, is required.

A trust center can support key generation and management. In particular, a trust center can provide recipients with secure key storage to prevent the loss of a key. For this purpose, however, the recipient must not only enter into a contractual relationship with an email provider or another message deliverer, but also enter into a contractual relationship with the trust center. A sender may need to retrieve keys for multiple recipients from multiple trust centers and ensure that they use the correct key of the recipient when encrypting a message. A trust center can additionally issue certificates for electronic signatures to certify the identity of a communication partner.

In one variation, a message delivery agent may act as a one-stop shop for secure messaging. The applicant offers such a method, for example, with the E-Postbrief. Both the recipient and the sender then only need a contract with the message courier, and they are provided with all the necessary functions for secure communication. A trust center can create a key for a user, who will then be managed by the message handler. A sender can receive the required keys from the message delivery agent and also deliver messages there. In order not to require any technical or organizational measures on the part of the recipient, the encrypted messages can be decrypted on the message handler's side when the message is retrieved by the recipient on a server of the message carrier and transmitted to the recipient via a secure connection. Due to high demands on the identification of the participants and the provision of an address qualification service, the message transmitter can also determine or check the recipient address for the sender and ensure correct delivery.

US 2011/293098 discloses a key recovery process for a lost or damaged key, where a password must be entered by a user.

General description of some exemplary embodiments of the invention

One of the objects of the invention is to support decryption of encrypted data in an alternative way to existing approaches. Another object of the invention is to enable a particularly user-friendly and at the same time particularly secure decryption of encrypted data.

The object is achieved by a method according to claim 1, a device according to claim 4 a program according to claim 6, a A method according to claim 7, an apparatus according to claim 15, a program according to claim 17 and a system according to claim 18.

Further embodiments can be found in the dependent claims.

For a first aspect, an exemplary embodiment of a method performed by a device assumes that a first device is configured to provide a secret key of a user of the device, and that a second device is configured to provide data to the user , The method includes logging in to the second device under authentication of the user. The method further comprises receiving encrypted data from the second device. The method further comprises generating a one-time password. The method further comprises encrypting the one-time password using a public key of the first device. The method further comprises transmitting the encrypted one-time password to the second device and causing the second device to retrieve the user's secret key from the first device using the encrypted one-time password and a key identifier associated with the user in the second device. The method further comprises receiving the user's secret key encrypted by the first one-time password device from the second device. The method further comprises decrypting the user's secret key using the one-time password. The method further comprises decrypting the encrypted data using the user's secret key.

For a second aspect, for an exemplary embodiment of a method performed by a device of a first device, it is assumed that a second device is configured to provide data to a user. The method comprises receiving a key identifier and a one-time password encrypted by a device of a user and encrypted with a public key of the first device from a second device storing an association between users and key identifiers. The method further comprises reading out a user's secret key encrypted with the key identifier based on the key identifier from a memory of the first device. The method further comprises decrypting the encrypted secret key of the user by means of the key identifier. The method further comprises decrypting the encrypted one-time password using a private key of the first device. The method further comprises encrypting the user's secret key with the one-time password. The method further comprises communicating with the One-time password of the user's encrypted secret key to the second device for forwarding to the user's device to enable it to decrypt encrypted data received from the second device.

Thus, for certain exemplary embodiments, the invention contemplates that the provision of data and the provision of a secret key for decrypting the data are separated. The key is provided by a first device and the data from a second device. The device of a user nevertheless communicates directly only with the second device. The second device itself has only one assignment of the user to a key identifier. The user can be identified for this assignment in any manner, for example by means of a user name specified at login or a user address for electronic messages. Encrypted data for the user is transmitted to the user device by the second device in encrypted form. The user device generates a one-time password, encrypts it with a public key of the first device, and forwards it to the second device. The second device forwards the encrypted one-time password together with a key identifier stored for the user to the first device. The first device decrypts the one-time password, retrieves a stored, encrypted secret key of the user based on the key identifier, decrypts it with the key identifier and encrypts it with the one-time password. The first device forwards the user's newly encrypted secret key to the user device via the second device. After a decryption of the secret key with the one-time password, the user device can now decrypt the encrypted data.

A possible advantage of the invention is that the user himself does not have to keep a secret key in his device in stock. As a result, the user does not need to ensure that the secret key is securely kept from the access of others and that it is not lost. In addition, the user can access the same, centrally stored secret key, if appropriate via a plurality of devices. Another possible advantage of the invention is that the user still only has to communicate with one device; If the operator of the second device occurs as a full-service provider, in certain embodiments the user only needs a contract with the latter. Another possible advantage of the invention is that when using a one-time password for the transport of the secret key for the generation of the password in certain embodiments no User input is required. The approach could thus be made particularly comfortable for the user and be independent of the login procedure with which a user logs on to the second device for retrieving data.

For particularly confidential information, there may be particularly stringent requirements for securing that only the intended recipient can use the information provided. This may, for example, concern professional secrets of certain professional groups, such as doctors or lawyers, who are subject to special secrecy obligations. Another possible advantage of the invention lies in the fact that, despite the user's access to a single device, the separation between the provision of data and the provision of keys makes it possible to achieve particularly high security with regard to confidentiality. That is, no device stores both encrypted data and the secret key required for decryption - even in encrypted form. The decryption is done exclusively in the domain of the recipient, i. on the user device. The one-time password can ensure that the user's secret key is also secured during transmission to the user via the second device. Since the one-time password itself is encrypted during transmission to the first device via the second device, the second device also does not receive access to the one-time password at any time.

An exemplary device according to the invention according to the first aspect comprises means for carrying out the method according to the invention according to the first aspect. The device may be, for example, a user terminal or a module for a user terminal.

An exemplary device according to the invention according to the second aspect comprises means for carrying out the method according to the invention according to the second aspect. The device may be, for example, a server or a module for a server. The server may in turn belong to a device such as a trust center.

The means of the devices according to the first or second aspect could each comprise hardware and / or software components. In an exemplary embodiment, the means could comprise only one circuit in which corresponding functions are implemented in hardware. In another exemplary embodiment, the means could comprise at least one processor and at least one memory with a suitable program.

Thus, for the first and second aspects, an exemplary embodiment of a device according to the invention comprises at least one processor and at least one memory, wherein a program comprising program instructions is stored in the memory, and wherein the memory and the program are arranged to communicate with the processor at least to cause the device to carry out the inventive method according to the first aspect or according to the second aspect when the program is executed on the processor. By way of example, the device is set up by software in order to be able to carry out the method. In particular, the preparation of the device, which is necessary in order to be able to execute a method, for example in the form of a program on the processor, should be understood as being set up by software.

A processor should be understood to mean inter alia one or more control units, microprocessors, microcontroller units such as microcontrollers, digital signal processors (DSP), application specific integrated circuits (ASIC) or field programmable gate arrays (FPGA).

A memory is, for example, a program memory and / or a main memory of the processor. A program memory is to be understood inter alia a non-volatile memory and a main memory, a volatile or a non-volatile memory, in particular a random access memory (RAM) and / or a flash memory. Non-volatile memories are e.g. Random access memory (RAM), e.g. NOR flash memory or with sequential access, e.g. NAND flash memory and / or read only access memory (ROM), e.g. EPROM, EEPROM, or ROM memory. The memory may be designed, for example objective.

For the first and second aspect, an exemplary embodiment of a program according to the invention comprises program instructions, wherein the program instructions cause an apparatus for carrying out the method according to the first aspect or according to the second aspect, when the program is executed by the processor. A program can be distributed, for example, via a network such as a local area network, a wide area network, a virtual area network, a radio network, such as a mobile radio network, another telephone network and / or the Internet. A program may be at least partially software and / or firmware of a processor. For example, the program according to the invention is stored in a memory of the device according to the invention according to the first or second aspect. It understands itself, that the term program can be understood in each case also a compilation of several programs.

For the first and the second aspect, an exemplary embodiment of a storage medium according to the invention stores a program according to the invention according to the first or second aspect. The storage medium is, for example, a computer-readable storage medium, which contains the program according to the invention and is designed, for example, as a magnetic, electrical, electro-magnetic, optical and / or different type of storage medium. The storage medium may in particular be a physical and / or physical storage medium. The storage medium is for example portable or permanently installed in a device. "Computer readable" is to be understood in particular as meaning that the storage medium can be read from and / or written to by a computer or a data processing device, for example by a processor. The storage medium is, for example, a program memory of a processor.

In an exemplary embodiment, a system according to the invention comprises a first device with a device according to the second aspect and a memory for storing a plurality of user key-encrypted secret keys. Furthermore, the system may comprise any further components, for example the second device and / or a device according to the first aspect.

In an exemplary embodiment, the device according to the first aspect is caused by program instructions permanently stored in a local memory of the device and executed by a processor of the device to perform the method. In an exemplary embodiment, the device according to the first aspect is caused by program instructions received via a browser and executed by a processor of the device to perform the method. The program instructions can be provided, for example, by the second device in the form of a Java applet or another application and only temporarily stored temporarily in a working memory in the device. This may have the advantage of not requiring installation of a program with the program instructions, as well as updates of an installed program.

For the second aspect, in an exemplary embodiment, the user's secret key encrypted with the key identifier may be in the memory of the first Device with assignment to a cryptographically derived from the key identifier value to be stored. In the first device, a value could then be derived cryptographically for a received key identifier. The reading out of the encrypted with the key identifier secret key of the user could then be based on the cryptographically derived value of the received key identifier. The storage of the encrypted secret key with assignment to a cryptographically derived value of the key identifier can offer the advantage that only with knowledge of the key identifier the secret key can not be easily retrieved from a memory of the first device. An example of a cryptographic derived value is a hash value that is obtained by means of a hash function.

For the second aspect, in an exemplary embodiment, a stored encrypted secret key of a user may be previously generated by the device of the first device when a request is received from the second device to generate a secret key for a user. The device of the first device can then generate a secret key for a user, in particular independently of a user input. The device of the first device may also generate a key identifier for the secret key for the user. The device of the first device may encrypt the secret key for the user with the key identifier and store the encrypted secret key in the first device for retrieval by a device of the user via the second device. Generating a secret key for a user independent of user input may provide the advantage that no communication with the user is required for the generation of the key.

It is understood that this particular generation of a secret key for a user by a device of a first device is also to be regarded as an independent invention.

For the second aspect, in an exemplary embodiment, the key identifier may be communicated to the second device for storing the key identifier associated with a user. This can offer the advantage that the first device for a query of a secret key for a user need not receive any direct information about the respective user.

For the second aspect, in one exemplary embodiment, the device may be the first Device in the context of the generation of a secret key from the generated key identifier cryptographic derive a value store the cryptographically derived value in the memory of the first device associated with the encrypted with the key identifier secret key, and delete the key identifier in the first device. For example, a hash value can again be used as the cryptographically derived value.

The secret key of the user may be, for example, a key for symmetric encryption or, for example, the private key of a key pair for asymmetric encryption.

For the second aspect, in the latter case, the device of the first device may further generate a public key for the user. The public key can then be stored only in the first device. Alternatively, it could be transmitted to the second means for storing only in the second device. Storing in the second device could have the advantage that the public key can be accessed more easily, for example if another user wishes to send encrypted data to the user with the public key. Thus, in the second device, public keys generated by different first devices could also be stored. Since the public key is not secret, it can be easily stored in the second device and kept ready for retrieval. From the first device, the public key could again be retrieved only indirectly via the second device and thus more cumbersome, since in the first device preferably no assignment of the user to the stored keys is present. Further alternatively, the public key of the user could be stored in the first device and transmitted in addition to the second device for storing in the second device. This may provide the advantage that the public key can be retrieved directly from the second device in a simple manner, while a backup copy is present in the first device.

The encrypted data may be of any kind and previously made available to the second device by any party. In an exemplary embodiment, the encrypted data has been encrypted by a third party device and provided to the second device. These may be, for example, encrypted parts or attachments of electronic messages. In another example Embodiment, the encrypted data was encrypted by a device of the user and provided to the second device. This may be, for example, data that has been outsourced to conserve local storage capacity and / or to allow central access to the data.

Further advantageous exemplary embodiments of the invention can be found in the following detailed description of some exemplary embodiments of the present invention, in particular in conjunction with the figures. However, the figures should only serve the purpose of clarification, but not to determine the scope of the invention. The figures are not to scale and are merely intended to exemplify the general concept of the present invention. In particular, features included in the figures should by no means be regarded as a mandatory part of the present invention.

Brief description of the drawings

Fig. 1

ein Blockdiagramm einer Ausführungsform eines erfindungsgemäßen Systems;

Fig. 2

ein Ablaufdiagramme mit ersten beispielhaften Verfahrensschritten in den System aus Figur 1; und

Fig. 3

ein Ablaufdiagramme mit weiteren beispielhaften Verfahrensschritten in den System aus Figur 1.

In the figures shows:

Fig. 1

a block diagram of an embodiment of a system according to the invention;

Fig. 2

a flowchart with first exemplary method steps in the system FIG. 1 ; and

Fig. 3

a flowchart with further exemplary method steps in the system FIG. 1 ,

Detailed Description of Some Exemplary Embodiments of the Invention

The present invention will now be described by way of exemplary embodiments that support decryption of encrypted data.

FIG. 1 is a block diagram of an exemplary embodiment of a system according to the invention. The system includes a device 100, a first device 200, and a second device 300.

The device 100 is a user device, for example a personal computer (PC), a notebook, a tablet computer, a mobile telephone or any other device.

The device 100 comprises a processor 101 and, connected to the processor 101, a program memory 102, a RAM 103, a main memory 104, a communication interface (interface I / F) 105 and a user interface (user interface UI) 106.

The processor 101 could be a microprocessor. It could also be embedded in an integrated circuit (IC), for example along with a memory. By way of example, a chip 107, which could contain a circuit with the processor 101, the program memory 102 and the main memory 103, is indicated.

The program memory 102 stores programs with program instructions permanently, i. usually until a user causes a deletion. The programs include, for example, at least one browser program. The main memory 103 can be used, for example, to temporarily store various information, such as intermediate results, programs or individual program instructions or data to be processed. The main memory 104 may be used to permanently store user data and other data, such as electronic messages downloaded from a mailbox and their unencrypted or decrypted attachments.

The processor 101 is configured to execute programs and thereby cause the device 100 to perform certain actions. For this purpose, the processor 101 can access, for example, program instructions stored in the program memory 102 or else program instructions stored only in the working memory 103. In addition, any information from the processor 101 in the working memory 103 can be cached.

The communication interface 105 may be any interface that facilitates exchange of data between the device 100 and the second device 300, but particularly not necessarily over the Internet. It can be a radio interface that allows access to the Internet, for example via a local wireless network (WLAN) or via a mobile network. It can also be a wired interface that allows access to the Internet via a cable, such as a DSL or local area network (LAN).

The user interface 106 may include any components for data input by a user and presentation of data, such as a keyboard, a mouse, a microphone, a screen, a touch screen and / or a speaker, etc. It is understood that such components may be wholly or partially integrated into the device 100 in certain embodiments, but could also be connected to the device 100 via cable or radio.

The first device 200 may be, for example, a state-certified trust center.

The device 200 includes a server 210 and an external memory 220.

The server 210 comprises a processor 211 and, connected to the processor 211, a program memory 212, a RAM 213 configured as RAM, a main memory 214 and a communication interface (I / F) 215.

The processor 211 could be a microprocessor. It could also be embedded in an integrated circuit, for example together with a memory. Illustrated by way of example is a plug-in card 217 which contains a circuit with the processor 211, the program memory 212 and the main memory 213.

The program memory 212 permanently stores programs with program instructions intended for the operation of the server 210. The working memory 213 is adapted to temporarily store information. Main memory 214 is adapted to store a private key of a trust center key pair.

The processor 211 is configured to execute programs from the program memory 212 and thereby cause the first device 200 to perform certain actions. In this case, any information from the processor 211 can be temporarily stored in the main memory 213.

The communication interface 215 may be any interface that allows for exchange of data between the first device 200 and the second device 300, but not necessarily over the Internet, for example. It can in turn be a radio interface or a wired interface.

The external memory 220 may be configured to store data from a database. The database can be created in such a way that in each case a record can be accessed via a hash value of a key identifier. The data associated with a hash value includes a public key and a private key encrypted with the key identifier, where public key and private key form a key pair for a particular user. The private key is an exemplary secret key of a user. The user is not identifiable in the device 200.

It is understood that the device 200 can also be put together in any other way. Thus, memory 220 could also be integrated into server 210, or main memory 214 and external memory 220 could be pooled, either within server 210 or outside server 210. External memory 220 could also be provided by another server.

The second device 300 may be, for example, a message courier device.

The device 300 also includes a server 310 and an external memory 320.

The server 310 comprises a processor 311 and, connected to the processor 311, a program memory 312, a RAM 313 configured as RAM, a main memory 314 and a communication interface (I / F) 315.

The program memory 312 is a storage medium storing programs intended for the operation of the server 310. In particular, a program could also include data for a website provided by the message handler. The main memory 313 is adapted to temporarily store information. The main memory 314 is adapted to store user master data. In addition, the main memory 314 could store a public key of the trust center 200 if it is not intended to be stored in the main memory 104 of user devices 100.

The processor 311 is configured to execute programs from the program memory 312 and thereby cause the second device 300 to perform certain actions. In this case, any information from the processor 311 in the main memory 313 be cached.

The communication interface 315 can be any interface that allows an exchange of data between the second device 300 and a user device 100 on the one hand and the second device 300 and the first device 200 on the other hand. It can in turn be a radio interface or a wired interface. It goes without saying that two different interfaces can also be provided for communication with user devices and the first device.

The external memory 320 may be configured to store data from a database. For example, the database may provide electronic message mailboxes to various users. Attachments can optionally be saved separately. These can be encrypted or unencrypted. If they are encrypted, they are encrypted with the public key of a key pair of the mailbox user.

It is understood that the device 300 can also be put together in any other way.

The system includes a program with program instructions for supporting decryption of encrypted user-side data. The program could be an embodiment of a program according to the first aspect of the invention.

The program could be installed in program memory 102. In this case, the program memory 102 could be an embodiment of a computer-readable storage medium according to the first aspect of the invention, and the device 100 or the chip 107 could be an embodiment of a device according to the first aspect of the invention.

Alternatively, the program could be, for example, an application permanently stored in program memory 312 or in main memory 314 of server 310, and downloaded from processor 310 via a browser stored in program memory 102, as needed, and stored in memory 103 as needed can. Such an application could be implemented, for example, as a Java applet. In this alternative, program memory 312 and main memory 314, respectively, could be an embodiment of a computer-readable storage medium according to the first aspect of the invention, as well as FIG Memory 103 as long as the application is stored in the working memory 103. The device 100 or the chip 107 could accordingly be an embodiment of a device according to the invention according to the first aspect as long as the application is stored in the working memory 103.

The system further includes a program with program instructions for supporting decryption of encrypted data on the server side. The program could be an embodiment of a program according to the second aspect of the invention.

For example, it could be stored in program memory 212. In this case, the program memory 212 could be an embodiment of a computer-readable storage medium according to the second aspect of the invention, and the server 210 or the plug-in card 217 could be an embodiment of a device according to the second aspect.

The device 100 and devices 200 and 300 are made FIG. 1 can be modified in many ways, both by omitting components and by adding components. This may result in additional or alternative benefits.

For example, the functions of message issuer facility 300 could be implemented in Applicants' E-POSTBRIEF system; the functions of the trust center could, for example, be implemented in the applicant's separate system Signtrust; and the data provided could be e-mail letters that can be deposited by a sender at a web portal of the E-POSTBRIEF system and retrieved there by a recipient.

Figures 2 and 3 13 are flowcharts illustrating exemplary embodiments of methods according to the first and second aspects of the invention.

The illustrated actions of the user device 100 are exemplified when the processor 101 executes a program loaded via a browser and stored in memory 103. The depicted actions of message issuer device 300 are executed when processor 311 retrieves and executes a corresponding program from program memory 312. The shown actions of the trust center 200 are executed when the processor 211 retrieves and executes a corresponding program from program memory 212. The illustrated communications between user device 100, device 300 of FIG Message dispenser and the trust center 200 via the respective communication interface 105, 315, 215 using the Internet.

FIG. 2 initially refers to the generation of a private user key according to the second aspect.

The user device 100 is not directly involved here. It merely requests the activation of portal use in advance if a user wishes to use a service provided by the message carrier for the transmission of electronic messages. The message handler unlocks the portal usage when all intended conditions are met, and creates a set of user master data for the user. The user master data is stored in the main memory 314. For example, they may include data for authentication of the user, such as a username or message delivery address, and a password.

If the requested portal usage has been enabled for a user at the message originator, the message delivery facility 300 automatically requests the generation of a key pair for asymmetric encryption at the trust center. (Action 401)

The trust center 200 then generates a key pair for the user without external specifications by the user or the message delivery agent. (Action 402) The key pair consists of a private key and a public key, whereby data encrypted with the public key can only be decrypted with the private key.

The trust center 200 continues to generate a unique key identifier (key ID) for the generated key pair. (Action 403)

The trust center 200 transmits the key identifier and the public key to the message delivery facility 300, which stores the two values in the user master data for the user in the main memory 314. (Action 404) This completes the initialization of the key pair for the new user.

The trust center 200 also encrypts the user's private key with the key identifier. (Action 405)

The trust center 200 derive a hash value (or hash) from the key identifier. (Action 406) For example, a perfect hash function is used for this, so that a different hash value results for each possible key identifier.

The trust center 200 now stores a new record in the external memory 220. The record comprises the hash value of the key identifier, and associated therewith the public key and the encrypted private key. (Action 407)

Finally, the trust center 200 deletes the plaintext of the generated private key and the plaintext of the generated key identifier. (Action 408)

Thus, the initialization of the key pair is also completed at the trust center 200.

If a sender now wants to send the user an electronic message with an encrypted attachment, the sender can request the public key of the user from the device 300. The device 300 may read the public key of the user from the main memory 314 based on a specified user name or a specified delivery address for the user from the user master data, for example, and make it available to the sender. The sender can then encrypt a file with the user's public key, append it to the message, and deliver the message to the message deliverer to the user.

All electronic messages are assigned to the recipient mailbox regardless of the type of delivery and its contents within the device 300 of the message carrier and stored access protected in memory 320.

FIG. 3 refers to the retrieval of a message with encrypted attachment by the user and the retrieval of an already generated and stored private key for decryption.

If a user wishes to retrieve inboxes, he may log in to the message issuer device 300 via a browser of the user device 100. (Action 501) The log-in may, for example, include the input and transmission of a username or a user delivery address and a password.

The device 300 then performs authentication and, after successful authentication, enables access to a user's mailbox. (Action 502) The authentication may be based on the user master data stored in main memory 314. For example, the device 300 could check whether there is a record of the transmitted user name in the user master data and whether a password corresponding to the transmitted password is stored for this purpose.

User device 100 may then retrieve the inbox at device 300. (Action 503)

The device 300 reads out all new messages for the user in memory 320 and transmits them to the user device 100. (Action 504) There, the messages can be displayed.

Attachments could be read out and communicated directly by device 300. Alternatively it can be provided that the user causes the user device 100 to retrieve the attachments of the displayed messages separately as needed. (Action 505) In this case, the device 300 first reads the selected attachments from the external memory 320 and transmits them to the user device 100. (Action 506) The browser of the user device 100 may maintain a representation of the file in the working memory 103.

The user device 100 now checks whether one of the received attachments is encrypted. (Action 507) If this is not the case, the content of the attachment can be output directly, for example via a screen, if it is text and / or image data.

If the attachment is encrypted, the user device 100 first needs the user's private key for decryption. This is not stored in the user device 100.

The user device 100 generates for this purpose a random key for a symmetric encryption, which is used as a one-time password or transport PIN (Personal Identification Number). (Action 508) The one-time password can be generated automatically and without involvement of the user and kept in the working memory 103. The user device 100 encrypts the one-time password with a public key of the trust center 200 and transmits it to the device 300 of the message exchanger. (Action 509) The public key may for example be stored permanently in the main memory 104 of the user device 100. However, it can also be stored, for example, in the main memory 314 of the message exchanger and made available to the user device 100 via the browser. For example, this could be done automatically if a first attachment is retrieved after logging in. The user device 100 could then temporarily store the public key of the trust center in the working memory 103 as long as the user is logged in to the message courier.

The transmission of the one-time password to the message courier may be accompanied by a request to retrieve the user's private key from the trust center, the request being in the form of a predetermined parameter value. Alternatively, the transmission of the one-time password can also receive the request implicitly, for example because the transmission takes place in a specific message or at a specific relative time in the communication between user device 100 and device 300 of the message exchanger.

In the device 300, the key identifier assigned to the user in the user master data is read from the main memory 314 and forwarded together with the encrypted one-time password to the trust center 200 in order to request the user's private key. (Action 510)

The trust center 200 derives a hash value of the key identifier. (Action 511) The same hash function is used for this purpose as in action 406 FIG. 2 ,

The trust center 200 searches in memory 220 for an encrypted private key of the user associated with the hash value. (Action 512)

The trust center 200 decrypts the user's private key with the key identifier. (Action 513)

The trust center 200 also reads the private key of the trust center from the main memory 214 and decrypts the received one-time password with the private key of the trust center 200. (Action 514)

The trust center 200 can now encrypt the decrypted private key of the user with the decrypted one-time password. (Action 515) The obtained key code and the user's decrypted private password can now be deleted again in the trust center 200.

The encrypted private key is transmitted from the trust center 200 to the message delivery facility 300. (Action 516)

The message delivery facility 300 transmits the encrypted private key to the browser of the user device 100. (Action 517)

Within the browser of the user device 100, the encrypted private key of the user can now be decrypted using the one-time password stored in the main memory 103. (Action 518)

The private key of the user is now in plain text in the browser, and the encrypted attachment stored in the main memory 103 can now be decrypted with this private key. (Action 519)

The content of the decrypted attachment can then be stored in the main memory 104 and / or output via the user interface 106, for example by display on a screen, depending on the user specification.

The user's one-time password, encrypted attachments, and private key may be deleted in the random access memory 103 when all available encrypted attachments have been decrypted and / or when the user logs out of the message deliverer via the browser.

Apart from the user's registration with the message courier, the procedure might be off FIG. 3 run without user input. It could be completely non-transparent and automatic. That is, it would not be apparent to the user if an electronic message has an unencrypted attachment or an encrypted attachment. In order to indicate to the user however the peculiarity of the received message and trust in the To promote procedures can be provided to show the process of decryption and the result clearly visible to the recipient.

The actions of user device 100 in FIG FIG. 3 illustrate an exemplary embodiment of a method according to the first aspect of the invention. The actions of the trust center 200 in Figures 2 and 3 illustrate an exemplary embodiment of a method according to the second aspect of the invention.

In exemplary embodiments of the invention, the key generation in the trust center 200 is thus anonymous. Here, an assignment of a key to a user is not known, and when using a hash function or other cryptographic derivation even the assignment of a key identifier to an encrypted private key is only temporary. A local reconstruction of the key identifier in the trust center 200 and thus the decryption of the private key of users is not possible. In addition, the private key (in encrypted form) is stored exclusively in the trust center 200. There is thus a separation between key management and data storage, so that it is ensured that no party receives independent access to keys and data. For a potential attacker, this means that he must be able to successfully penetrate at least two of the three parties and access the data in order to decrypt an encrypted message.

In addition, all data can be stored encrypted in the device 300 of the message delivery as well as in the trust center 200 with additional system keys, so that the attacker would have to bring this into his power. In the browser of the user device 100, there is no persistence of data in certain embodiments. This means that a potential attacker could try to access data in the browser only at runtime. For the actual transmission of data in the system, any other security measures can be provided, such as secure data transmission by means of the Transport Layer Security (TLS) protocol in the context of a HyperText Transfer Protocol Secure (HTTPS) application.

Planning and organizational measures by the recipient are not required, since all necessary funds can be made available via a browser.

Since the retrieval of the private key takes place by means of a one-time password as a transport PIN, the is generated independently of a user password, the approach is also independent of the login method used. This means that no measures have to be provided that the user password, which is finally transmitted to the message deliverer upon login, is initially modified so that the message delivery person can not draw any conclusions about the transport PIN.

It is understood that the illustrated and described methods can be varied within the scope of the invention in many ways, both by adding, omitting, varying and interchanging individual actions. For example, actions 513 and 514 could also be performed in reverse order or in parallel. Furthermore, for example, the application of a hash function to the key identifier in actions 406 and 511 could be dispensed with. The key identifier could then be stored in clear text in action 407 also in the trust center, and used in action 512 in plain text to search for the private key. Furthermore, the method can not be used only for attachments of electronic messages. It could also be used if the message itself is to be encrypted.

The example presented approach could also be used for other services than a message delivery service. A second device - similar to the device 300 - could, for example, belong to a database provider which stores data for users in the network. In that case, a first device-for example, again a trust center-could optionally also generate a symmetric key for a user instead of an asymmetrical key pair and keep it available as a secret key. This can be done essentially the same way as in FIG. 2 shown. Here, instead of the private key of the key pair, a key for symmetric encryption is then generated, encrypted and stored, and the generation, transmission and storage of the public key is completely eliminated. The user device could then retrieve the symmetric encryption key stored in the first device each time stored cryptographic data is read to decrypt the data in the user device. This can be done essentially the same way as in FIG. 3 shown. Instead of messages and attachments, the user device only retrieves data from a memory in the second device, and instead of the user's private key, a user's key is used for symmetric encryption. The user device could also be encrypted each time data for storage in the second device first, in a similar manner, retrieve the symmetric encryption key stored in the first device.

The illustrated or described compounds between components are to be understood as functional compounds. They can be implemented directly or indirectly via several other components. The described actions can be implemented in different ways; so an implementation is conceivable not only in software (by program instructions) but also only in hardware or in a combination of both. Each of the illustrated components may also be formed by a plurality of components. Thus, instead of each processor, a plurality of processors could be used and instead of each memory component a plurality of memory components. Multiple processors and / or multiple memory components could also be distributed among multiple servers of a particular device.

It is understood that the embodiments described are merely examples that can be modified and / or supplemented in the context of the claims in many ways. In particular, each feature described for a particular embodiment may be used alone or in combination with other features in any other embodiment. Each feature described for one embodiment of a particular category may also be similarly employed in an embodiment of another category.

Claims (18)

1. Method performed by an apparatus (100), wherein a first installation (200) is configured to provide a secret key of a user of the apparatus, and wherein a second installation (300) is configured to provide data for the user, the method comprising:

   - logging on to the second installation (300) with authentication of the user,

   - receiving encrypted data from the second installation (300),

   - creating a one-time password,

   - encrypting the one-time password by means of a public key of the first installation (200),

   - transmitting the encrypted one-time password to the second installation (300) and causing the second installation (300) to retrieve the secret key of the user from the first installation (200) by means of the encrypted one-time password and a key identification allocated to the user in the second installation (300),

   - receiving the secret key of the user, which was encrypted by the first installation (200) with the one-time password, from the second installation (300),

   - decrypting the secret key of the user by means of the one-time password and

   - decrypting the encrypted data by means of the secret key of the user.
2. Method according to claim 1, wherein the one-time password is created automatically, when it is determined that encrypted data has been received from the second installation (300).
3. Method according to claim 1 or 2, wherein the apparatus (100) is caused to perform the method

   - by program instructions stored in a local memory (102) of the apparatus (100) and executed by a processor (101) of the apparatus or

   - by program instructions received via a browser and executed by a processor (101) of the apparatus (100).
4. Apparatus (100) comprising means (101, 102, 103) for performing the method according to one of claims 1 to 3.
5. Apparatus according to claim 4, wherein the apparatus is a device (100) or a module (107) for a device (100).
6. Program comprising:

   - program instructions, wherein the program instructions when executed by a processor (101) cause an apparatus (100) to perform the method according to one of Claims 1 to 3.
7. Method performed by an apparatus (210) of a first installation (200), wherein a second installation (300) is configured to provide data for a user, the method comprising:

   - receiving a key identification and a one-time password, which was generated by an apparatus (100) of a user and encrypted with a public key of the first installation (200), from the second installation (300) which stores an allocation between users and key identifications,

   - reading a secret key of the user, which is encrypted with the key identification, based on the received key identification from a memory (220) of the first installation (200),

   - decrypting the encrypted secret key of the user by means of the key identification,

   - decrypting the encrypted one-time password by means of a private key of the first installation (200),

   - encrypting the secret key of the user with the one-time password and

   - transmitting the secret key of the user encrypted with the one-time password to the second installation (300) for passing on to the apparatus (100) of the user, in order to enable the user to decrypt encrypted data received from the second installation (300).
8. Method according to claim 7, further comprising cryptographically deriving a value from the received key identification, wherein the secret key of the user encrypted with the key identification is stored in the memory (220) of the first installation (200) with an allocation to a value cryptographically derived from the key identification, and wherein reading the secret key of the user encrypted with the key identification is based on the cryptographically derived value of the received key identification.
9. Method according to one of claims 7 and 8, wherein a stored, encrypted secret key of a user is generated beforehand by the apparatus (210) of the first installation (200) as follows:

   - receiving a request from the second installation (300) to generate a secret key for a user,

   - generating a secret key for a user independent of a user input,

   - generating a key identification for the secret key for the user,

   - encrypting the secret key for the user with the key identification and

   - storing the encrypted secret key in the memory (220) of the first installation (200) for retrieval by an apparatus (100) of the user via the second installation (300).
10. Method according to claim 9, further comprising:

    - sending the key identification to the second installation (300) for storage of the key identification with an allocation to a user.
11. Method according to one of claims 9 and 10, further comprising:

    - cryptographically deriving a value from the generated key identification,

    - storing the cryptographically derived value in the memory (220) of the first installation (200) with an allocation to the secret key encrypted with the key identification and

    - deleting the key identification in the first installation (200).
12. Method according to any one of claims 9 to 11, wherein the secret key

    - is a private key of a key pair for asymmetric encryption or

    - a key for symmetric encryption.
13. Method according to any one of claims 9 to 12, wherein the secret key is a private key of a key pair for asymmetric encryption, further comprising generating a public key for the user and

    - storing the public key in the first installation (200) only, or

    - transmitting the public key to the second installation (300) for storage in the second installation (300) only, or

    - storing the public key in the first installation (200) and transmitting the public key to the second installation (300) for storage in the second installation (300).
14. Method according to any one of claims 9 to 13, wherein the encrypted data

    - was encrypted by a third party apparatus and made available to the second installation (300), or

    - was encrypted by a user apparatus and made available to the second installation.
15. Apparatus (210) comprising means (211, 212) for performing the method according to any one of claims 7 to 14.
16. Apparatus according to claim 15, wherein the apparatus is a server (210) or a module (217) for a server (210).
17. Program comprising:

    - program instructions, wherein the program instructions when executed by a processor (211) cause an apparatus (210) to perform the method according to any one of claims 7 to 14.
18. System comprising a first installation (200) having an apparatus (210) according to claim 15 or 16 and a memory (220) for storing a plurality of secret keys of users encrypted with key identifications, as well as the second installation (300).

Images